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We introduce a new fragment of Linear temporal logic (LTL) called LIO and a new class of Biichi 
automata (BA) called Almost linear Biichi automata (ALBA). We provide effective translations be- 
tween LIO and ALBA showing that the two formalisms are expressively equivalent. While standard 
translations of LTL into BA use some intermediate formalisms, the presented translation of LIO into 
ALBA is direct. As we expect applications of ALBA in model checking, we compare the expressive- 
ness of ALBA with other classes of Biichi automata studied in this context and we indicate possible 
applications. 

1 Introduction 

The growing number of concurrent software and/or hardware systems puts more emphasis on develop- 
ment of automatic verification methods applicable in practice. One of the most promising methods is 
LTL model checking. The main problem of this verification method is the state explosion problem and 
consequent high computational complexity. While symbolic approaches to model checking partly solve 
the problem for hardware systems, there is still no satisfactory solution for model checking of software 
systems. The most promising approach seems to be a combination of abstraction methods, reduction 
methods, and optimized model checking algorithms. Reduction methods and optimizations of the al- 
gorithms are often based on some specific properties of the specification formula or the model. For 
example, one of the most effective reduction methods called partial order reduction employs the fact 
that specification formulae usually do not use the modality next and thus they describe stutter-invariant 
properties (6). 

We have realized that all formulae of the restricted temporal logic |[T0l (i.e. formulae using only 
temporal operators eventually and always) can be translated to Biichi automata that are linear (1-weak), 
possibly with an exception of terminal strongly connected components. These terminal components have 
also a specific property: they accept only infinite words over a set of letters, where some selected letters 
appear infinitely often. We call such automata Almost linear Biichi automata (ALBA). In this paper we 
study mainly the expressive power of these automata. 

Searching for the precise class of LTL formulae corresponding to ALBA automata results in the def- 
inition of an LTL fragment named LIO (the abbreviation for linear and infinitely often). The fragment is 
strictly more expressive than the restricted temporal logic. To prove that LIO corresponds to ALBA, we 
present translations between LIO and ALBA. While standard translations of LTL formulae into BA use 
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either generalized Biichi automata or alternating 1-weak Biichi automata ©El as an intermediate 
formalism, the presented translation of LIO to ALBA works directly. Further, there exist LIO formu- 
lae such that the corresponding Biichi automata created by the mentioned standard translations are not 
ALBA. 



Related work Some observations regarding specific structure of Biichi automata corresponding to 
some LTL fragments have been already published in (T). The paper states that two classes of Manna 
and Pnueli's hierarchy of temporal properties (8), namely guarantee and persistence formulae, can be 
translated into terminal and weak automata, respectively. A Biichi automaton is terminal, if every ac- 
cepting state has a loop transition under each letter. An automaton is weak if each strongly connected 
component consists either of accepting or non-accepting states. The paper also suggests some improve- 
ments of the standard model checking algorithms employing the specific structure of the considered 
property automata. Let us note that LIO is incomparable with both guarantee and persistence formulae. 

The paper is structured as follows. Section|2]recalls the definition of LTL and introduces LIO. Various 
kinds of Biichi automata including almost linear BA are defined in Section [3] Translations are presented 
in Section[4](ALBA — > LIO) and Section [5] (LIO — > ALBA). Section [6] sums up the presented results and 
mentions some topics for future research. 



2 Linear temporal logic (LTL) 

The syntax of Linear Temporal Logic (LTL) fiTI is defined as follows 

q> ::= tt \ a | -i<p | <pV<p | <pA<p | F<p | G(p | X<p | <pU<p, 

where tt stands for true, a ranges over a countable set AP of atomic propositions, F, G, X, and U are modal 
operators called eventually, always, next, and until, respectively. The logic is interpreted over infinite 
words over the alphabet L = 2 AP ', where AP' C AP is a finite subset. Given a word u = m(0)m(1)m(2) . . . G 

it; we denote the i suffix of u, i.e. = u(i)u(i+ 1) 

The semantics of LTL formulae is defined inductively as follows: 



1= tt 






\= a 


iff 


a £ w(0) 




iff 


u tf= (p 




iff 


u \= (pi or u \= q> 2 


N <Pl A <P2 


iff 


u \= q>i and u\= (f>2 




iff 


3i>0. U{ \= (p 




iff 


V/ > . Ui \= (p 


hx<p 


iff 


ui\=(p 


h (pi u <?>2 


iff 


3i>0.(uj \=(pi and VO < j < i 



We say that a word u satisfies (p whenever u |= (p. Given an alphabet E, a formula <p defines the language 

L z ((p) = {ueL m \u\=q>}. 

For a set {0\ , . . . , O,,} of modalities, LTL(Oi , . . . , O n ) denotes the LTL fragment containing all for- 
mulae with modalities 0\,...,O n only. We will use mainly the fragments LTL(F,G) with modalities 
eventually and always and LTL() without any modalities. Note that an LTL() formula describes only a 
property of the first letter of an infinite word. Hence, we say that a letter eGl satisfies an LTL() formula 
a, written e \= a iff ew \= a for some w € Z 60 . 
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2.1 The LIO fragment 



The LIO fragment is defined as 



<p ::= y | <pV<p | <pA<p | X(p | aU<p, 



where i// ranges over LTL(F, G) and a over LTL(). 

The fragment does not fit into any standard taxonomy of LTL fragments (see |[T2l ). but it is a gener- 
alization of two standard LTL fragments: 

• LTL(F, G) - the fragment of all LTL formulae using operators F and G only. This fragment is also 
known as restricted temporal logic iflOl . 

• flatLTL + (U,X) - the fragment of all flat LTL(U,X) formulae in positive form. A formula is flat ||2l 
if the left subformula of each U operator is from LTL(). A formula is in positive form if there is 
no modal operator in the scope of any negation. 

In Subsection 13.21 we show that LIO contains also all languages expressible as negations of LTL det for- 
mulae. The fragment LTL det is better known as the common fragment of CTL and LTL Q. 

The LIO fragment covers many specification formulae frequently used in the context of model check- 
ing, for example typical response formulae of the form G(a Fb). In fact, it is more important that LIO 
contains negations of these formulae, as only the negations needs to be translated into Biichi automata. 

3 Biichi automata (BA) 

Definition 1. A Biichi automaton (BA or automaton for short) is a tuple A = (£, Q,qo, 8,F), where 

• £ is a finite alphabet, 

• Q is a finite set of states, 

• <7o £ Q is an initial state, 

• 8 : Q xL—>2@ is a transition function, and 

• F QQis a set of accepting states. 

We usually write p — » q instead of q G 8(p,e). A Biichi automaton is traditionally seen as a directed 
graph where nodes are the states and there is an edge leading from p to q and labelled by e whenever 
p A q. An edge p A p is called a loop on p. 

A run % over an infinite word m(0)m(1)m(2) . . . G Z w is a sequence 



where ro = qo is the initial state. The run is accepting if some accepting state occurs infinitely often in 

the sequence ro, r\ , The language L(A) defined by automaton A is the set of all infinite words u such 

that the automaton has an accepting run over u. 

A state q is reachable from p, written p — > q, if p = q or there exists a sequence 



% = r 






"(2) 

r 2 -> . . . 




r n +i 



where p = ro and q = r n+ \. 
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A strongly connected component (SCC or component for short) is a maximal set of states S C <2 such 
that p q holds for every p,q GS. Note that every state of an automaton belongs to exactly one strongly 
connected component. 

Several special classes of Biichi automata have been considered in the context of model checking so 
far. A Biichi automaton (£, Q,qo, 8,F) is called 

• terminal if for each p £ F and a € £ it holds that 8(p,a) ^ and 8{p,a) C F, 

• wect& if every SCC of the automaton contains only accepting states or only non-accepting states, 

• k-weak for some k > if it is weak and every SCC contains at most k states, 

• linear or very weak if it is 1-weak. 

Linear Biichi automata can be alternatively defined as automata where each SCC consists of one state, 
i.e. each cycle is a loop. 

Given an automaton A and its state q, by A q we denote the automaton A where the initial state is 
changed to q. Further, a strongly connected component S is called terminal if for all p £ S it holds that 
p — > q implies q £ S. To improve the notation, we often label a transition of a Biichi automaton with an 
LTL() formula a meaning that there is a transition under each e £ £ satisfying a. 

3.1 Almost linear Biichi automata (ALBA) 

In this section we introduce a new kind of Biichi automata and describe its relation to the previously 
defined types. 

Definition 2. Almost linear Biichi automaton (ALBA ) is a Biichi automaton A over an alphabet £ = 2^' 
such that every non-terminal SCC contains just one state and for every terminal component S there exists 
a formula 

p = G(Xq A f\ GFa, 

l<i<n 

such that n > 0, OCq, a\ , . . . , a„ £ LTL(), and for every q £ S it holds that L(A q ) = L z (p). 

Note that our condition on terminal components does not describe their concrete structure. In fact, 
a formula GoSo A Ao<k« GFa, can be translated into a (Biichi automaton with a single) component in 
at least three reasonable ways. We illustrate them by automata corresponding to the formula p = Gtt A 
GFa\ A GFc?2- 

1. If we want to minimize the number of transitions and states of the automaton, we create just a 
"cycle" depicted on Figure [T] 

2. In the context of LTL model checking, a Biichi automaton A derived from an LTL formula is 
usually used to build a product automaton that accepts all words accepted by A and corresponding 
to some behaviour of the verified system. Model checking algorithms then decide whether there is 
an accepting cycle in the product automaton or not. If we want to keep the number of states of A 
minimal and to shorten the length of potential cycles in product automata, we add to the automaton 
A some shortcuts, see Figure 12 

3. If we want to minimize the length of potential cycles in product automata without regard to the 
number of states, we translate the formula p into the automaton given in Figure [3] Note that the 
number of states is exponential in the length of p , while it is only linear in the previous two cases. 

In practice, the second kind of translation is usually chosen. 
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a i A«2 



Figure 1: Minimal number of transitions. Figure 2: Minimal number of states and shortcuts. 




Figure 3: Shortest cycles in product automata. 



3.2 Hierarchy of Biichi automata classes 

Figure 0] depicts the hierarchy of the mentioned classes of Biichi automata. A line between two classes 
means that the upper class is strictly more expressible than the lower class. If the figure does not indicate 
such a relation between a pair of classes, then the classes are incomparable. 

Indicated inclusions follow directly from definitions of the classes. The strictness of these inclusions 
is always easy to prove and the same holds also for the indicated incomparability relations. Note that 
only two of the considered classes can express the language of the formula GFa: ALBA and the general 
class. 

It is worth mentioning that the class of linear BA is expressively equivalent to negations of LTL det 
formulae Q. 
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(general) BA 
weak BA 



ALBA 



3-weak BA 



2-weak BA 



linear B A ( 1 -weak B A) terminal B A 

Figure 4: Hierarchy of Biichi automata classes. 



4 Translation ALBA LIO 

Let A = (£, Q,qo, S,F) be an ALBA. For every state q € Q, we recursively define a LIO formula q>(q) 
such that L(A q ) = L L ((p(q)). There are two cases: 

• q is in a terminal strongly connected component. Due to the definition of ALBA, there exists a 
formula 

p = Gao A f\ GFa, 

\<i<n 

such that n > 0, CCq, OL\, . . . , On € LTL(). We set q>(q) = p. Note that p is a formula of LTL(F, G). 

• q is not in any terminal component. Let q ^ q, q % q, . . ., q % q be all loops on q and q % q\, 
q-^qi, ■ ■ ■» q qm be all transitions leading from q to other states. Then we set 



f ( \/ at) U \/ (bjAX<p(qj)) 

0<i<n 0<j<m 



(p(q) = < 



( \/ fli) U V (^AX<p( 9; ))) V G V «i 

0<i'<n 0< _/<m 



if q^F, 
if qeF. 



0<i<n 



Note that <p{q) is in LIO assuming that all (p(qj) are in LIO. 



The correctness of the recursion follows from the fact that A is linear (except the terminal compo- 
nents). The whole automaton then corresponds to the formula (p(qo). 



5 Translation LIO -> ALBA 



In this section, we always assume that LIO formulae are in positive form, i.e. no temporal operator is 
in scope of any negation. Every LIO formula can be transformed into this form using the following 
equivalences. 
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^G(p = F-i<p 



n(<p 1 V<p 2 ) = -<Pi A->9z 



For each LIO formula <p, we define its size as follows: 

• if (p is in LTL(), we set size(cp) = 1, 

• if 9 is not in LTL(), we define its size recursively: 



size(<pi V 92) 
«ze(<Pl A (P2) 
size(F(p) 
size(G(p) 
size{X(p) 
size(ccU(p) 



size{(p\) + l+size(q>i) 

size(cpi) + 1 +size(q>2) 

l+siz.e((p) 

2*size(q>) 

l+size((p) 

l+siz.e((p) 



Let S be a finite set of LIO formulae. We define its size as 

sizeifb) = (0,-) 

size(S) = (k,(i k ,ik-i,---,h)) 

where k = max{size{q>) \ (p G S} and ij = \ {(p | <p G 5 A siz,e((p) = j}\ for each > 7 > 1. Finally, we 
define a strict (lexicographical) order < on sizes of these sets in the following way. 



(&,(ijfc,ijfc_i,...,ii)) < (Z,(//,7/_i,...,7i)) 



& < / V 

(fc = l A 3fc>m> 1 . / m < 7„, A Vfc > n > m . /„ = 7„) 



The translation is based on transformation of a LIO formula into an equivalent formula of a special 
form. Formally, to every LIO formula <p we assign a set R((p) C LTL() x i^„(LIO), where i^„(LIO) is 
the set of all finite subsets of LIO, such that 

<p^ V («AX/\a). 

(a,S)eR(<p) aeS 

The set R((p) is defined recursively. The recursion is always bounded as each R((p') appearing in the 
definition of R((p) satisfies size((p') < size((p). In the following, a always represents a formula of LTL(). 
We define R((p) according to the structure of <p. 

/?(«) = {(«,©)} 



<PiV<p 2 R(q>i V<P2) =R((pi)UR((f>z) 



91 A<p 2 R(q>i A<p 2 ) ={(«i Aa 2 ,5iU5 2 ) I (oti.Si) G/?(«pi),(a 2 ,5 2 ) £#(<P2)} 



F<p R(F(po) = {(tt,{F<po})}\JR(<po 



X(f)o R(X( Po ) = {(tt,{( Po })} 



aU<p /?(aU(po) = {(a,{aU(po})}U7?((po) 



G90 This case is divided into the following subcases according to the structure of <po^ 
R(Ga) = {(a,{Ga})} 



<PiA<p 2 R(G((p\ A 92)) = R(G(pi A G92) 
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- F<pi This case is again divided into the following subcases according to the structure of 91 : 

j] fl(GF oc) = {0,{GFa})} 
93 V 94 | /?(GF(<p3 V<p 4 )) =7?(GF(p 3 )U7?(GF<p 4 ) 

As conjunction is an associative operator, we can see it as an operator of 



93 A <p 4 



arbitrary arity and we can assume that all conjuncts are not conjunctions. Then either 
all conjuncts are formulae of LTLQ (i.e. 93 A 94 G LTL() - this case has been already 
covered by the Case GFa), or at least one conjunct has the form 95 V 96 or F95 or G95. 
Let 94 be this conjunct and 93 be conjunction of all the other conjuncts. We proceed 
according to the structure of 94. 

• 95 V 96 I AsGF(9 3 A(95V96)) = GF(93A95)vGF(9 3 A96),weset 
7?(GF(93 A (95 V 9 6 ))) = /?(GF(93 A 95)) UR(GF((p 3 A (p 6 )). 

■ F95 As GF(93 A F95) = (GF93) A (GF95), we set 
tf(GF(93 A F95)) = /?((GF9 3 ) A (GF95)). 

• G95 As GF(9 3 A G95) = (GF93) A (GFG95) = (GF93) A (FG95), we set 
/?(GF(93 A G95)) = R((GF(p 3 ) A (FG95)). 

R(GF(p 3 ) 

R(FG(p 3 ) 



F93 



G93 



R(GFF(p 3 ) - 
tf(GFG93) 



91 V 92 The situation is similar to the Case GF(92 A 94). Hence, either 91 V 92 G LTLQ 
(this has been already solved in Case Got), or we can assume that 92 has the form 93 A 94 or 
F93 or G93. We proceed according to the structure of 92. 

As G(9i V (93 A 94)) = G(9i V 93) A G(9i V 94), we set R(G((p\ V (93 A 
^{(a l Aa 2 ,S 1 {JS 2 ) I (a!,^) G/?(G(9! V9 3 )),(a 2 ,5 2 ) G/?(G(9! V94))}. 
As G(9i VF93) = (G91) VF(93 AXG9Q VGF93 = (G9Q VtfU(93 A(XG9i))V 
GF93, we set fl(G(9i V F93)) = R{Gq>i) UR(tt\J (93 A (XG9Q)) URiGFcfc). 



93 A 94 



94))) 



F93 



G93 R(G((pi V G93)): Here we consider only the following two structures of the whole 



subformula 91 V G 93 (the other possibilities fit to some of the previous cases): 



V«p'eG G( P' As GOv^eG G< P') = V 9 'gg( G( P')> we set 
tf(G(V 9 < eG G9')) = lV eG tf(G9')- 



aVV 9 ' € G G< P' AsG(aVV^ e G G< P') 



(Ga) V V(p'eG( G< P') v Vip'eci 01 A XG(a V G9'), we set 

R(G(a V y 9 , eG G9')) = R(Ga) U U^RiGy') U lV eG {(«, {G(a V G<p')})}. 



G91 R(GG(pi) =R(Gy l ) 



Moreover, for every finite set of LIO formulae, we define 

R(S)=R(/\q>). 

(pes 

In particular, R(<d) = {(tt,d))}. 

Before we provide the construction of ALBA automaton for a given LIO formula, we mention some 
crucial observations. First of all, one can readily confirm the following observation. 



Lemma 3. For every (a,S) £ R((p) it holds that, for each q>' G S, either 9' = 9 or size(q>') <size((p). 
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In fact, there are only five cases where (p' = (p, namely if (p has the form F<po or a U (po or Ga or GFa 
or G(a V G<p') (this is a special case of the form G(a V Vp'eG G<p'))- Lemma [3] together with an analysis 
of the listed cases directly implies the following property. 

Lemma 4. For every (a,S) G 7?({<p}), e/f/j<?r 5 = {<p} or size(S) < size({(p}). 

This lemma immediately implies the following one. 

Lemma 5. Let S be a finite set of LIO formulae in positive form. For every ((X,S') G R(S) it holds that 
S = S' or size(S') < size(S). 

If we look at the five cases mentioned above LemmaHl we can easily see that only two of them have 
the property that R((p) = (a,<p), namely the cases Ga and GFa. This is the crucial argument for the 
following observation. 

Lemma 6. Let S be a finite set of LIO formulae in positive form. It holds that 

S C {Ga, GFa | a G LTL()} iff (a,S ! ) G R(S) S = S'. 

Now we are ready to finish the translation. Let (p be a LIO formula in positive normal form and let 
AP' be the set of all atomic propositions occurring in (p. We describe the ALBA automaton in a concise 
form: terminal components will be described by distinguished states labelled with the corresponding LTL 
formulae of the form p = Goo A /\ 1<i<B GFa,-. A standard ALBA can be obtained from this concise form 
very easily: we just replace every such a state by a corresponding component (as indicated in Figures [Q 
12 or|3]). 

The automaton corresponding to (p is constructed as (£, Q,qo, S,F), where 
. L = 2 AP ', 

• Q = 2 M and M = {<p' \ <p' is a LIO formula over AP' and siz.e{(p') < size(cp)} is a set subsuming 
all formulae that can be derived from (p by repeated applications of /?(•) (see LemmaO, 

• Qo = M, 

• For each e € £ and S G Q, we set S(S,e) = {S' j (a, S') G R(S) and e \= a}, 

• accepting states appear only in terminal components. Due to Lemma [6l terminal components 
correspond to states S satisfying S C {Ga, GFa | a G LTL()}. Hence, we label such a state 5 with 
the formula 

(G f\ a) A /\ GFa 

GaeS GFaeS 

of the desired form. 

The language equivalence between q> and the constructed automaton follows from the properties of 
R(-). The constructed automaton is ALBA due to Lemma [5] (linearity except terminal components) 
and Lemma [6] (condition on terminal components). Note that the translation directly provides triple 
exponential bound on the size of Q in the length of (p (even size(cp) can be exponential in the length of 
(p). However, we conjecture that the size of Q is in fact only singly exponential in the length of (p. 

A natural question is whether standard translations of LTL into BA also produce ALBA 
when applied to LIO. The answer is negative. For example, Gastin and Oddoux's 
popular implementation of the translation via alternating automata [4] (available online at 
http://www.lsv.ens-cachan.fr/~gastin/ltl2ba/index.php) transforms the LIO formula 
G(G(a V Fb) V G(c V Fd)) into a Biichi automaton that is not ALBA (it contains nonterminal strongly 
connected components of size greater than one). 
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6 Conclusion 

We have introduced a new class of Biichi automata called almost linear Biichi automata (ALBA). We 
have compared the expressive power of ALBA with other classes of Biichi automata. Further, we have 
identified a fragment of LTL called LIO and equivalent to ALBA. The LIO fragment subsumes some 
previously studied LTL fragments, in particular the restricted temporal logic and negations of LTL det , 
i.e. the common fragment of CTL and LTL. We have provided a direct translation of LIO formulae 
into Biichi automata (BA). In contrast to standard translations of LTL into BA, our translation does not 
use any intermediate formalism and always produces ALBA. We expect that the specific structure of 
ALBA can lead to development of algorithms designed especially for model checking of negations of 
LIO properties. To emphasize potential usability of such algorithms, we have analysed the collection of 
the most often verified properties called Specification Patterns Q. It shows up that negations of 89% of 
the properties can be expressed as LIO formulae and hence translated to ALBA. 

References 

[1] Ivana Cerna & Radek Pelanek (2003): Relating Hierarchy of Temporal Properties to Model Checking. In: 
Proceedings of the 30th Symposium on Mathematical Foundations of Computer Science (MFCS'03), Lecture 
Notes in Computer Science 2747. Springer- Verlag, pp. 318-327. 

[2] Dennis R. Dams (1999): Flat Fragments of CTL and CTL*: Separating the Expressive and Distinguishing 
Powers. Logic Journal of the IGPL 7(1), pp. 55-78. 

[3] Matthew B. Dwyer, George S. Avrunin & James C. Corbett (1998): Property Specification Patterns for Finite- 
State Verification. In: Proc. 2nd Workshop on Formal Methods in Software Practice (FMSP-98). ACM Press, 
New York, pp. 7-15. 

[4] Paul Gastin & Denis Oddoux (2001): Fast LTL to Biichi Automata Translation. In: G. Berry, H. Comon 
& A. Finkel, editors: Proceedings of the 13th International Conference on Computer Aided Verification 
(CAV'01 ), Lecture Notes in Computer Science 2102. Springer- Verlag, pp. 53-65. 

[5] Rob Gerth, Doron Peled, Moshe Y. Vardi & Pierre Wolper (1995): Simple On-the-fly Automatic Verification 
of Linear Temporal Logic. In: Protocol Specification Testing and Verification. Chapman & Hall, pp. 3-18. 

[6] Leslie Lamport (1983): What good is Temporal Logic? In: R. E. A. Mason, editor: Proceedings of the IFIP 
Congress on Information Processing. North-Holland, Amsterdam, pp. 657-667. 

[7] Monika Maidl (2000): The common fragment of CTL and LTL. In: D. C. Young, editor: Proceedings of the 
41st Annual IEEE Symposium on Foundations of Computer Science (FOCS'00). IEEE Computer Society 
Press, pp. 643-652. 

[8] Zohar Manna & Amir Pnueli (1990): A hierarchy of temporal properties. In: Proceedings of ACM Sympo- 
sium on Principles of Distributed Computing (PODC'90). ACM Press, pp. 377-410. 

[9] David E. Muller, Ahmed Saoudi & Paul E. Schupp (1988): Weak alternating automata give a simple expla- 
nation of why most temporal and dynamic logics are decidable in exponential time. In: Proceedings of the 
3rd Annual IEEE Symposium on Logic in Computer Science (LICS'88). IEEE Computer Society Press, pp. 
422^127. 

[10] Dominique Perrin & Jean-Eric Pin (2004): Infinite words, Pure and Applied Mathematics 141. Elsevier. 

[1 1] Amir Pnueli (1977): The temporal logic of programs. In: Proc. 18th IEEE Symposium on the Foundations 

of Computer Science, pp. 46-57. 
[12] Jan Strejcek (2004): Linear Temporal Logic: Expressiveness and Model Checking. Ph.D. thesis, Faculty of 

Informatics, Masaryk University in Brno. 
[13] Moshe Y. Vardi (1995): An Automata-Theoretic Approach to Linear Temporal Logic. In: Banff Higher Order 

Workshop, Lecture Notes in Computer Science 1043. Springer, pp. 238-266. 



